IN THE UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF GEORGIA 
ATLANTA DIVISION 

DONNA CURLING, et al., ) 

Plaintiff, ) 

) Civil Action 

V. ) 

) File No. 1:17-CV-2989-AT 

BRAD RAFFENSPERGER, et al., ) 

Defendant. ) 

CONSOLIDATED/JOINT DISCOVERY STATEMENT REGARDING 
COALITION PLAINTIFFS’ FIRST REQUEST FOR PRODUCTION 

The Coalition Plaintiffs and State Defendants, being unable to resolve a 

diseovery dispute despite having met and eonferred in good faith, present this Joint 

Statement to the Court and request the Court’s assistance in resolving the dispute. 

I. Request to Produce November 6,2018 GEMS Databases 

On Mareh 27, 2019, Coalition Plaintiffs served State Defendants with a 

request to produee the GEMS Databases. Coalition Plaintiffs requested eleetronie 

eopies of the GEMS Databases for the November 6, 2018 eleetion, both the 

eleetion eonfiguration version sent to eaeh Georgia eounty prior to an eleetion and 

the eompleted version the eounties sent baek after the eleetion to the Seeretary, as 

well as passwords neeessary to aeeess the Databases. On June 5, 2019, State 

Defendants objeeted to the request. On June 10, 2019, the parties met and 

eonferred in good faith about this issue and eonferred again by phone on June 19, 

2019, but were unable to eome to a resolution. 
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a. Coalition Plaintiffs’ Position 


The State told the Fulton County Superior Court on January 9, 2019, “[T]he 
souree eode and the means of aeeessing the GEMS, of eourse, is highly 
eonfidential, but the data from the GEMS is public record.” Coalition for Good 
Governance v. Crittenden, No. 2018-cv-313418, Hr’g Tr. 88:22-24 Jan. 9, 2019 
(Ga. Sup. Ct. 2019). Coalition Plaintiffs seek the GEMS Databases because they 
are the authoritative, authentic, original record of that data, and reflect the manner 
in which the electronic ballots, the DRE machines, and tabulation computers were 
configured. We do not seek the source code or access to the GEMS Server in this 
request. Coalition Plaintiffs need the Databases in their original format in order to 
conduct meaningful analysis of the election data. 

The GEMS Databases are central to the disputes in this case because they 
are central to Georgia’s voting system. They provide the ballot information that is 
loaded onto the DREs for each election and then record the cast vote records that 
are sent back to the State after the election. As such, they provide a roadmap for 
any coding or configuration errors, security breaches, machine malfunctions, 
tabulation irregularities, or other issues. 

The GEMS Databases are not the GEMS Server; they are not source code or 
other sensitive software. Each GEMS Database is just a Microsoft Access file that 
contains the ballot and DRE configuration instructions in a master worksheet 
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format before the eleetion, and the votes east, eleetion results, and reporting 
formats after the eleetion. All publie reports of the eleetion results are generated 
from the GEMS Databases. At no point have State Defendants explained how or 
why the GEMS Databases contain sensitive or secure information that would 
jeopardize election security if disclosed; they simply assert conclusory generalities. 
Electronic worksheet analysis and digital forensic examinations are common in 
many lawsuits involving trade secrets, financial records, and other (actually) 
sensitive information. If the Court decides that disclosure of some data in the 
GEMS Databases could compromise election security—which Coalition Plaintiffs 
dispute—a reasonable protective order will suffice for sensitive data. See Dem. 
Party ofAriz. v. Pima County Bd. of Supervisors, No. 20072073 (Ariz. Sup. Ct. 
Dec. 18, 2007) (ordering public disclosure of a GEMS database after trial assessing 
potential security risks posed from such disclosure). 

If the State were complying with its legal requirements to preserve ballot 
secrecy, there would not be any personally identifiable information in the GEMS 
Databases. Production of the Databases will shed light on this core legal claim. 

As Coalition Plaintiffs attempted to explain at the 26(f) conference, we do 
not want the actual passwords the State uses. We only need whatever is necessary 
to access the produced files; it could be a novel password made for this production, 
b. State Defendants’ Response 
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The Secretary’s position regarding the disclosure of information about 
Georgia’s election system has been consistent—sensitive and secure information 
which could jeopardize election system security should not be disclosed. Prior to 
the start of discovery and the Rule 26(f) conference, Coalition Plaintiffs served 
document requests seeking electronic copies of GEMS Databases and all 
passwords to the databases. The Secretary tried to engage the Coalition Plaintiffs in 
a discussion about alternatives to producing the GEMS database, but the Coalition 
Plaintiffs have refused. The Secretary has continuously worked in good faith to 
produce relevant information to Plaintiffs, but producing the entire GEMS 
Database with passwords is not proportional to the needs of the case. 

The GEMS Databases are protected and carefully guarded under state law 
and are unique to the state of Georgia—which runs a version not used in any other 
state. See O.C.G.A. §§ 21-2-379.24(g); 21-2-500; Ga. Comp. R. & Reg. rr. 183-1- 
12. Courts in Georgia have also recognized that releasing the GEMS Databases and 
passwords would compromise election security. See Smith v. Dekalb Cnty., 288 
Ga. App. 574, 577-78 (2007). As this Court noted in its September 17, 2018 Order 
[Doc. 309], elections systems are considered Critical Infrastructure by DHS and 
“rapidly evolving cybertechnology changes and challenges have altered the reality 
now facing electoral voting systems and Georgia’s system in particular.” See [Doc. 
309 at 38.] Disclosing the GEMS Database will heighten those challenges. 
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The Secretary continues to be amenable to producing documents populated 
with data from the GEMS databases, as discussed at the May 31 conference. The 
Secretary previously proposed a protocol which, in conjunction with a protective 
order, would provide information relevant to the claims and proportional to the 
needs of the case without jeopardizing election security. See [Doc. 386-1]. The 
Secretary also offered for Plaintiffs’ experts speak directly with the Secretary’s 
staff about other alternatives. The Court suggested a similar approach to addressing 
these issues at the May 31 scheduling conference. (Transcript at 30:14-23.) Given 
the limitations of what is included in the GEMS Database compared with the 
software functions on the GEMS Server, it is likely possible to assess whether any 
malware exists on relevant GEMS Servers without disclosing the GEMS Database. 
However, Coalition Plaintiffs insist solely on the production of the GEMS 
Databases and passwords without any protective order. 

Producing the GEMS database would disclose information about the 
architecture of Georgia’s election system, which is currently protected to maintain 
election security. The structure of Georgia’s GEMS database is extremely 
important to anyone interested in hacking the current election system and infecting 
it with malware, but it is not necessary information to assessing whether alleged 
vulnerabilities in the election system exist or have been exploited. As such. 
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producing the entire GEMS Database with passwords is not proportional to the 
needs of the case. 

c. Coalition Plaintiffs’ Reply 

The GEMS Database is just a worksheet in Microsoft Access. If the 
disclosure of the GEMS Databases would harm the election system, why do other 
states make it public?^ Defendants claim Georgia’s GEMS Databases are different 
but do not explain how, or why such differences override judicial review. 

Plaintiffs asked whether any particular data fields were sensitive. Defendants 
demurred. They refused to produce the GEMS Databases even under protective 
order, despite distributing them to 159 counties without nondisclosure agreements. 

Smith is inapplicable. Its plaintiff sought a disc containing both a GEMS 
Database and sensitive information; the Court held the State had no Open Records 
obligation to separate the former from the latter. 288 Ga. App. 574, 577-78 (2007). 

Defendants confirmed they have no expert on GEMS Database issues. 
Plaintiffs are ready to provide their experts’ testimony on the structure of GEMS 
Databases and any other GEMS-related issue. Reports and derivative data from a 
GEMS Database, without the Database itself, are insufficient for forensic analysis. 


' Pima County, Bev Harris, Elections Industry: Voting System Technical 
Material, Manuals, Troubleshooting, Black Box Voting.org (Jan. 8, 2014), 
http://blackboxvoting.org/voting-svstem-technical-information/ (linking, inter alia, 
to GEMS Databases from Alaska and California). 
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CERTIFICATE OF COMPLIANCE 


Pursuant to L.R. 7.1(D), the undersigned hereby certifies that the foregoing 
CONSOLIDATED/JOINT DISCOVERY STATEMENT REGARDING 
COALITION PLAINTIFFS’ FIRST REQUEST FOR PRODUCTION has been 
prepared in Times New Roman 14-point, a font and type selection approved by the 
Court in L.R. 5.1(B). 


/s/ David Brody 
David Brody 
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CERTIFICATE OF SERVICE 


I hereby eertify that on this day, I electronieally filed the foregoing 
CONSOLIDATED/JOINT DISCOVERY STATEMENT REGARDING 
COALITION PLAINTIFFS’ FIRST REQUEST FOR PRODUCTION with the 
Clerk of Court using the CM/ECF system, whieh will automatieally send eounsel 
of record e-mail notification of such filing. 

This 21st day of June, 2019. 

/s/ David Brody 
David Brody 
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